Take the 2-minute tour ×
Super User is a question and answer site for computer enthusiasts and power users. It's 100% free, no registration required.

Can anyone give me examples of the

TCPDUMP -G

use with 60 seconds as a example and incremental files?

like :

tcpdump -w %s -G 60

i try it but don't increment files only reset the file each 60 seconds.

share|improve this question
add comment

1 Answer

up vote 1 down vote accepted

Any chance you have upper-case %S instead of %s? If so, it's doing exactly what you tell it to:

  • -w %S create a file named strftime("%S") seconds into each minute, i.e. 15 for arguments sake
  • -G 60 recreate it every 60 seconds, i.e. at 15 seconds into each minute

If you want to capture files in minute-sized chunks you can use %s lower-case, or better still something like %H%M%S.cap, these should work:

tcpdump -w %s -G 60
tcpdump -w %H%M%S.cap -G 60

See the strftime man page for details on the specifiers. Otherwise what you describe is normal behaviour for just -G with no %-specifiers in the -w option. I'm not aware of any bugs related to the -G option.

The %s specifier is a GNU extension to strftime(), it's been present in glibc since glibc-2.0 (1997), however it may cause a problem with non-glibc libraries, though both dietlibc and uClibc have supported it since 2006 and 2002 respectively. I cannot think of anything else that would cause strftime() to not support %s (unless you are not running linux: on Solaris I would expect to get a capture file called %s which was reset every 60 seconds).

share|improve this answer
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.